Submission Details
Severity:
Might deposit too low of an amount
Summary
The deposit() function in BridgeRouterFacet.sol may allow some users to deposit too little of a token
Vulnerability Details
function deposit(address bridge, uint88 amount)
external
nonReentrant
onlyValidBridge(bridge)
{
if (amount < Constants.MIN_DEPOSIT) revert Errors.UnderMinimumDeposit();
// @dev amount after deposit might be less, if bridge takes a fee
uint88 zethAmount = uint88(IBridge(bridge).deposit(msg.sender, amount)); // @dev(safe-cast)
...
The first line in this function enforces the user to deposit a minimum amount. However there is no guarantee that there will not be a fee taken during that deposit. If a fee is taken then the resultant 'zethAmount' may now potentially be less than said minimum.
Impact
Low - some user might have too small a balance. They can always add a little more
Tools Used
Visual inspection
Recommendations
Add another check to see if 'zethAmount' is >= Constants.MIN_DEPOSIT
Prize pool breakdown
Total prize
55,000 USDC
nSLOC
3,36516 USDC / LOC
50,000 USDC
5,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.